http://www.wpexplorer.com/protect-wordpress-admin-area/
Guarding your WordPress admin area and login page against attack is vital. However, while hackers are a major security risk, they’re not the only one. For sites providing user registration, you’ll also need to secure the admin area against the users themselves. Security issues that result from approved users are called ‘non-malicious intrusions’.
Fortunately, you can shore up your website
Source: Security Feed